Skill Auditor Pro

This skill appears to implement a reasonable audit workflow, but review these points before installing or running it: 1) Ensure the host has 'clawhub' (and optionally the 'gemini' CLI) if you plan to use fetch or LLM analysis — the skill does not declare these requirements. 2) Be cautious with the L3 step: the script copies 'suspicious' code to /tmp and instructs an agent/LLM to analyze it — that can leak secrets or sensitive code to whatever model/service you invoke. Prefer running the audit locally and reviewing findings yourself rather than sending raw suspicious files to remote LLMs or public APIs. 3) Confirm the external reporting address (steipete@gmail.com) and any IoC lists are from a trusted source before using them. 4) If you need to proceed: run the script in an isolated environment, inspect its output and the /tmp artifact contents manually, and only use LLM analysis on redacted content that removes any credentials or secrets. If you want a safer verdict, provide: where this skill was published (homepage/source repo), whether 'clawhub' and 'gemini' are available in your environment, and whether you intend to allow the agent to send suspicious code to external LLM services.